{"record":{"id":"edcbbbd1f9015423","repo":"XTLS/Xray-core","slug":"failed-to-use-decryption","errorCode":null,"errorMessage":"failed to use decryption","messagePattern":"failed to use decryption","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/vless/inbound/inbound.go","lineNumber":113,"sourceCode":"\t\tpolicyManager:          v.GetFeature(policy.ManagerType()).(policy.Manager),\n\t\tstats:                  v.GetFeature(stats.ManagerType()).(stats.Manager),\n\t\tvalidator:              validator,\n\t\toutboundHandlerManager: v.GetFeature(outbound.ManagerType()).(outbound.Manager),\n\t\tobserver:               v.GetFeature(extension.ObservatoryType()),\n\t\tdefaultDispatcher:      v.GetFeature(routing.DispatcherType()).(routing.Dispatcher),\n\t\tctx:                    ctx,\n\t}\n\n\tif config.Decryption != \"\" && config.Decryption != \"none\" {\n\t\ts := strings.Split(config.Decryption, \".\")\n\t\tvar nfsSKeysBytes [][]byte\n\t\tfor _, r := range s {\n\t\t\tb, _ := base64.RawURLEncoding.DecodeString(r)\n\t\t\tnfsSKeysBytes = append(nfsSKeysBytes, b)\n\t\t}\n\t\thandler.decryption = &encryption.ServerInstance{}\n\t\tif err := handler.decryption.Init(nfsSKeysBytes, config.XorMode, config.SecondsFrom, config.SecondsTo, config.Padding); err != nil {\n\t\t\treturn nil, errors.New(\"failed to use decryption\").Base(err).AtError()\n\t\t}\n\t}\n\n\tif config.Fallbacks != nil {\n\t\thandler.fallbacks = make(map[string]map[string]map[string]*Fallback)\n\t\t// handler.regexps = make(map[string]*regexp.Regexp)\n\t\tfor _, fb := range config.Fallbacks {\n\t\t\tif handler.fallbacks[fb.Name] == nil {\n\t\t\t\thandler.fallbacks[fb.Name] = make(map[string]map[string]*Fallback)\n\t\t\t}\n\t\t\tif handler.fallbacks[fb.Name][fb.Alpn] == nil {\n\t\t\t\thandler.fallbacks[fb.Name][fb.Alpn] = make(map[string]*Fallback)\n\t\t\t}\n\t\t\thandler.fallbacks[fb.Name][fb.Alpn][fb.Path] = fb\n\t\t\t/*\n\t\t\t\tif fb.Path != \"\" {\n\t\t\t\t\tif r, err := regexp.Compile(fb.Path); err != nil {\n\t\t\t\t\t\treturn nil, errors.New(\"invalid path regexp\").Base(err).AtError()","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/vless/inbound/inbound.go#L95-L131","documentation":"Thrown while constructing a VLESS inbound whose config.Decryption is set to something other than \"\" or \"none\". In that case an encryption.ServerInstance is initialized from base64url key segments (Decryption split on '.'), plus XorMode, SecondsFrom, SecondsTo and Padding. If that Init fails (bad key material, malformed parameters), this error wraps the cause.","triggerScenarios":"Setting \"decryption\" in a VLESS inbound to a non-\"none\" value whose dotted base64url key segments are invalid (wrong length after RawURLEncoding decode, empty segments), or supplying inconsistent XorMode/SecondsFrom/SecondsTo/Padding values.","commonSituations":"Copying an encryption-style decryption string from another deployment without the matching keys; typos in the base64url key; using standard base64 (+//) instead of raw URL encoding (-_ , no padding); clients/servers from versions with incompatible encryption parameters.","solutions":["If you do not intend VLESS encryption, set \"decryption\": \"none\" (or omit it) — this is the standard VLESS setting","If you do use it, verify each dot-separated segment is valid raw-base64url and decodes to the expected key length","Check XorMode and the SecondsFrom < SecondsTo window and Padding values against the peer's configuration","Read the wrapped Init error for the exact rejected parameter"],"exampleFix":"// before\n\"decryption\": \"ss-2022-blake3-aes-256-gcm.dGVzdA\"\n\n// after (standard VLESS, no extra encryption at protocol level)\n\"decryption\": \"none\"","handlingStrategy":"validation","validationCode":"// keep standard VLESS unless you truly need protocol-level encryption\nfunc normalizeDecryption(d string) string {\n    if d == \"\" { return \"none\" }\n    return d\n}\n// if using encryption keys, pre-validate each segment:\nfunc validKeySegments(dec string) bool {\n    for _, seg := range strings.Split(dec, \".\") {\n        b, err := base64.RawURLEncoding.DecodeString(seg)\n        if err != nil || len(b) == 0 { return false }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":"if err := handlerCreate(...); err != nil && strings.Contains(err.Error(), \"failed to use decryption\") {\n    log.Printf(\"VLESS decryption config rejected: %v — falling back to 'none' is not automatic; fix config\", err)\n}","preventionTips":["Default to \"decryption\": \"none\"","Pin client and server to the same xray version when using decryption","Use raw URL-safe base64 (no padding) for key segments"],"tags":["vless","encryption","config","base64"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}